Amazon Credentials Obfuscation Vulnerability in Perl Allowing Key Generation with Predictable Randomness

A vulnerability exists in the Amazon::Credentials Perl module, affecting versions through 1.2.0. The issue arises because the module uses the rand function to generate encryption keys, leading to predictable and insecure key generation. This vulnerability allows for the potential decryption of obfuscated AWS credentials, which are stored to prevent exposure in the event of a data dump. Prior to version 1.3.0, the module encrypted secrets with a 64-bit key derived from the rand function, creating a risk of key prediction and unauthorized decryption.

Impact

Exploitation of this vulnerability allows for the decryption of AWS credentials that have been obfuscated for security.

Remediation

Users can upgrade to Amazon::Credentials version 1.3.0 or later, where this vulnerability has been addressed.